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Synchronization of neural networks has been used for novel public channel protocols in cryp- 
tography. In the case of tree parity machines the dynamics of both bidirectional synchronization 
and unidirectional learning is driven by attractive and repulsive stochastic forces. Thus it can be 
described well by a random walk model for the overlap between participating neural networks. For 
that purpose transition probabilities and scaling laws for the step sizes are derived analytically. Both 
these calculations as well as numerical simulations show that bidirectional interaction leads to full 
synchronization on average. In contrast, successful learning is only possible by means of fluctuations. 
Consequently, synchronization is much faster than learning, which is essential for the security of the 
neural key-exchange protocol. However, this qualitative difference between bidirectional and unidi- 
rectional interaction vanishes if tree parity machines with more than three hidden units are used, 
so that those neural networks are not suitable for neural cryptography. In addition, the effective 
number of keys which can be generated by the neural key-exchange protocol is calculated using the 
entropy of the weight distribution. As this quantity increases exponentially with the system size, 
brute-force attacks on neural cryptography can easily be made unfeasible. 

PACS numbers: 84.35.-K, 87.18.Sn, 89.70.+C 
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I. INTRODUCTION 

Synchronization of neural networks [H, is a special 
case of an online learning situation. Two neural networks 
start with randomly chosen uncorrelated weights. In each 
time step they receive common input values, communi- 
cate their output to each other and use a suitable learning 
rule to update their weights. Finally, this process leads 
to full synchronization of corresponding weights in both 
networks. 

In the case of simple networks, e.g., perceptrons, there 
is no difference between unidirectional learning and bidi- 
rectional synchronization. However, for tree parity ma- 
chines (TPMs) an interesting phenomenon can be ob- 
served: two neural networks learning from each other 
synchronize much faster than a third network only lis- 
tening to the communication [2J. 

This effect has been applied to solve a cryptographic 
problem ||: Two partners A and B want to exchange a 
secret message over a public channel. In order to protect 
the content against an attacker E, who is listening to the 
communication, A encrypts the message. However, then 
B needs A's key for decryption. Without an additional 
private channel A and B have to use a cryptographic key- 
exchange protocol in order to generate a common secret 
key over the public channel :4j. This can be achieved 
by synchronizing two TPMs, one for A and one for B, 
respectively. Of course, the attacker tries to determine 
the key, too. But when learning is much slower than 
synchronization, a tree parity machine (TPM) trained 
by E is usually unable to synchronize before A and B 
have finished the key exchange. Therefore the success 
probability Pe of an attack is very small Q . 



Compared to other key-exchange algorithms neural 
cryptography needs only simple mathematical opera- 
tions, namely, adding and subtracting integer numbers. 
Thus it is possible to use this key-exchange protocol in 
devices with limited computing power. Computer scien- 
tists are already working on hardware implementations, 
which are part of an integrated circuit [fj, [7], 8, 9]. 

Since the first proposal of the neural key-exchange pro- 
tocol [|[ most research has been focused on finding more 
advanced methods for the partners [l(| HH, EH an d the 
attacker [l3l [l5j. However, the results of simulations 
and iterative calculations show the same scaling behavior 
in almost all cases: the success probability Pe decreases 
exponentially with increasing synaptic depth L [f| , while 
the average synchronization time i S ync only grows pro- 
portional to L 2 [l6|. Therefore L plays the same role 
in neural cryptography as the key length in traditional 
cry ptog raphic systems, which are based on number the- 
ory [151 ]. 

In this paper we analyze the synchronization process of 
two tree parity machines by the dynamics of the overlap 
p. First, we repeat the definition of basic algorithms of 
neural cryptography regarding synchronization and at- 
tacks in Sec. HIl In Sec. Mil we calculate the probabilities 
of attractive and repulsive steps for different types of in- 
teractions. The effect of these steps on the overlap is then 
presented in Sec. lIVI Here we show that the mechanisms 
for unidirectional learning and bidirectional synchroniza- 
tion are indeed different. In Sec. |V]we finally apply our 
results on the dynamics of neural synchronization in or- 
der to analyze the security of neural cryptography against 
brute-force attacks. For that purpose we use the entropy 
of the weight distribution to determine a scaling law for 
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FIG. 1: A TPM with K = 3 and N = 4. 



the number of keys which can be generated by the neural 
key-exchange protocol. 



II. NEURAL SYNCHRONIZATION 

The TPMs used by partners and attackers in neural 
cryptography consist of K hidden units, which are dis- 
crete perceptrons with independent receptive fields. The 
general structure of these networks is shown in Fig. [1] 
All input values are binary 



€{-!,+!} 



(1) 



and the weights are discrete numbers between — L and 
+L, 



e {-L,-L + l, 



-L} 



(2) 



Here the index i = 1, . . . , K denotes the ith hidden unit 
of the TPM and j = 1, . . . , N the elements of each vector. 
As usual, the output <Xj of a hidden unit is given by the 
sign of the scalar product of inputs and weights 



<7i = sgn(wj • Xj) 



(3) 



and the total output r of a TPM is defined as the product 
(parity) of the hidden units 



K 



(4) 



The two partners start with secret random weight vec- 
tors w A and w B , respectively. At each time step, a com- 
mon public input vector x is generated, and the partners 
exchange their output bits over the public channel. The 
weight vectors are updated, and the process is iterated 
until the partners have synchronized their weights which 
then are used for the secret key. Note that the hidden 
units af and af are secret, this is an essential mechanism 
for the security of neural cryptography 

We consider three different algorithms for the update 
of the weights in each time step. 

Synchronization: 
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In neural cryptography this algorithm is used by the part- 
ners A and B. Here we only consider the random walk 
learning rule [ItJ , because all other suitable learning rules 
(Hebbian and Anti-Hebbian) converge to it in the limit 
N -> oo [3. 
Simple attack: 



wf +x. i eK^)e(r-T-) 



(6) 



This method is the simplest algorithm for unidirectional 
learning. An attacker E can try it in order to synchronize 
with the partners A and B by training a TPM with the 
observed examples consisting of Xj and t a [3| . 

Geometric attack: The geometric attack is the most 
successful method for an attacker using only a single 
TPM [HI]. Here E tries to realize Eq. © without be- 
ing able to interact with A. As long as t e = t a , this can 
be achieved by just applying Eq. ©, as both learning 
rules have the same effect. However, in the case t e 7^ t a 
E cannot stop ^4's update of the weights. Instead of this 
the attacker uses additional information contained in the 
local fields 



hf = 



1 



N 



(7) 



of the hidden units in order to correct the output t e of 
her TPM. As a low absolute value \hf\ indicates a high 
probability of af 7^ af, the attacker flips the output of 
the hidden unit with minimal \hf\ before applying the 
learning rule ©. 

In all three cases weights Wij leaving the allowed range 
between —L and +L are reset to the nearest boundary 
value sga(wij)L. 

We analyze the process of synchronization using sim- 
ulations of finite systems as well as iterative calculations 
for N — ► 00 [HI EH- Correlations between the weight 
vectors of two corresponding hidden units i are described 
by (2L + l) 2 variables p l a b (t), which are defined as the 
probability to find a weight with w A \t) = a in A's tree 
parity machine and wf; = b in B's TPM at time t: 



pl b (t)=P(w A j (t)=aAwf j (t) = b). 



(8) 



While these quantities are approximately given by the 
frequency of the weight values w A - (t) and w E (t) in simu- 
lations, we use the equations of motion given in Ref. [IlJ 
to determine the time evolution of p\ b (t) directly in the 
limit N — * 00. 

In both cases the standard order parameters 
which are commonly used for the analysis of online learn- 
ing, can be calculated as functions of p l a b (t): 



Qt= ^wf-wf = E E fl V Q , b , (9) 

a— — L b=—L 

q?= -Uf -wf = E E &2 ^, b , (10) 



a— — L b— — L 



3 



1 


1 




1 

synchronization 




□ 


simple attack 


- 


<> 


geometric attack - 


1 




i 



0.2 



0.4 



0.6 



0.8 




FIG. 2: Effect of attractive (upper curve) and repulsive steps 
(lower curve) for K = 3 and L = 10. Symbols represent 
averages over 1000 simulations for N = 100. The lines denote 
the corresponding results obtained by iterative calculations 
for bidirectional synchronization and N — » oo. 
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The level of synchronization between two corresponding 
hidden units is then given by the normalized overlap [19j 
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Uncorrelated weight vectors at the beginning of the syn- 
chronization process have pi — 0, while the maximum 
value pi = 1 is reached for fully synchronized weights. 

All the update algorithms discussed above can be de- 
scribed by 
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(t)xi(t), (13) 



where f A ' B ^ E (t) is a function, which can take the values 
— 1, 0, or +1 according to the learning rule. Therefore 
only three different effects are possible. 

If //*(£) = fP(t) ^ 0, the weights in both correspond- 
ing hidden units are moved in the same direction, so that 
the overlap increases. This is called an "attractive step" 
and can be described as anisotropic diffusion 



Pa,b — 2 (Pa+1,6+1 +Po-l,6-l) 



(14) 



with reflecting boundary conditions. A sequence of these 
attractive steps finally reaches a fixed point at pi = 1. 

If only the weights of one hidden unit are updated, 
ff~(i) + ff(t) = ±1, the overlap pi decreases on average. 
This repulsive step performs a normal diffusion on a (2L+ 
1) x (2L + 1) square lattice 



P l a,b = 1 {p i a+l,b + 'Pa-X,b+P i a,b+l + PaM-l) 



(15) 



Of course, the boundary conditions are the same as 
above. For a sequence of these repulsive steps the fixed 
point of the overlap is located at pi = 0. 



FIG. 3: Scaling functions for attractive steps. These results 
were obtained in 1000 iterative calculations for bidirectional 
synchronization with K = 3 and N — » oo. 



For ff{t) = fP(t) = the weights stay at their posi- 
tion. Therefore the overlap does not change at all in this 
step. 

The remaining situation f^(t) = —ff(t) ^ cannot 
occur in any algorithm discussed above. 

In general, the change of the overlap Ap is not only a 
function of the current overlap, but depends also on the 
distribution of the weights and the type of step, which 
is denoted by a subscript if necessary: the effect of an 
attractive step is given by Ap a (p) 1 while we use Ap r (p) 
in the case of repulsive steps. Both quantities as well 
as Ap(p), which is not restricted to a particular type 
of step, are random variables, whose properties can be 
determined in simulations or iterative calculations. 

However, for special cases an analytical solution can be 
given by using Eqs. Q14p and (fT5"|) . taking the boundary 
conditions into account. At the beginning of the synchro- 
nization all weights are uniformly distributed, so that a 
repulsive step does not change the overlap, but an at- 
tractive step has a large effect: 



Ap a (p = 0) = 



12L 



(L + 1)(2L + 1) 2 



Ap r (p = 0) = 0. 



( 16 ) 

(17) 



In contrast, one observes the opposite situation for fully 
synchronized weights (p = 1): 



Ap a (p = l) = 0, 
A Pr (p = l) = - 



(£ + l)(2i + l) 



(18) 



Here an attractive step does not change the overlap at 
all, but a repulsive step has its maximum effect. 

Figure [2] shows that (Ap a (p)) and (Ap r (p)) do not de- 
pend on the synchronization algorithm. Consequently, 
the difference between unidirectional learning and bidi- 
rectional synchronization is caused by the probability of 
attractive and repulsive steps, but not their effects. 

Using Eqs. (fTB|) and (fTI)|) we obtain the rescaled quan- 
tities (Ap a (p))/Ap a (0) and (Ap r (p))/A j o r (l) which be- 
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FIG. 4: Scaling functions for repulsive steps. These results 
were obtained in the same way as those shown in Fig. [3] 



FIG. 5: Probability that updating the weights has a repulsive 
effect in one hidden unit for K — 3. 



come asymptotically independent of L for large synaptic 
depth. This is clearly visible in Figs. [3] and HI Therefore 
these two functions are sufficient to describe the effect of 
attractive and repulsive steps. 



III. TRANSITION PROBABILITIES 

All algorithms for neural synchronization have in com- 
mon that a repulsive step can only occur in the ith hidden 
unit, if the two corresponding outputs Oi are different. 
The probability for this event is given by the well-known 
generalization error [lXj ] 



6; = — arccos(/9i 

7T 



(20) 



of the perceptron. In the case of unidirectional learning 
mutual interaction does not happen. Therefore the prob- 
ability of repulsive steps for an simple attack is directly 
given by Eq. (|2^]) : 



Pi 



(21) 



However, if both hidden units agree on Oi, this does not 
always lead to an attractive steps, because Oi = r is 
another necessary condition for an update of the weights. 
Thus the probability of attractive steps is given by 



Pf 



1 



(22) 



in the case of learning with K > 1. 

In contrast, mutual interaction is an integral part of 
bidirectional synchronization. When t a ^ t b , that 
move of the weights would have a repulsive effect in at 
least one hidden unit, hence the partners A and B avoid 
it by not updating the weights. However, when an even 
number of hidden units disagrees on the output, one has 
t a = t b and the learning rule is applied. Taking all pos- 
sibilities into account, we find for K = 3 and identical 
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e) in all hidden units [Til ]: 
1 (l-e) 3 + (l 
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(23) 
(24) 



Because of P B < P^ the partners have a clear advantage 
over a simple attacker in neural cryptography. 

However, E can do better by taking the local field into 
account. Then the probability for <jf ^ of is given by 
the prediction error [2(3] 



1 — erf 



Pi 



(25) 



y2(i-p?) VQi i 

of a perceptron, which depends not only on pi but also 
on | hf | . This quantity is a strictly monotonic decreasing 
function of \hf\. Therefore the geometric attack is often 
able to find the hidden unit with of ^ of by searching 
for the minimum of \hf\. If all other units have o® = o A , 
then the probability for a successful geometric correction 
flU ] is given by 




■e ^ dhi 
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(26) 



Using this equation, we find for K = 3, geometric attack 
and identical overlap in all hidden units 
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(27) 
(28) 



While P B for the geometric attack is lower than for the 
simple attack, it is still higher than P B . Thus even 
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FIG. 6: Average change of the overlap for K = 3, L = 5, 
and N = 100. Symbols represent results obtained in 1000 
simulations. 



FIG. 7: Distribution of the overlap p at different time steps 
for K = 3, L = 5, N = 100, and geometric attack. These 
histograms show the result of 10 000 simulations. 



this advanced algorithm for unidirectional learning has a 
disadvantage compared to bidirectional synchronization, 
which is clearly visible in Fig. [5] 



IV. DYNAMICS OF THE OVERLAP 

The results presented in Sees. [XT] and IIIII indicate 
that the overlap p between two corresponding hidden 
units performs a random walk with position dependent 
step sizes (Ap a (p), Ap r (p)) and transition probabilities 
{Pa{p), Pr{p))- In order to understand the dynamics, we 
calculate the average change of the overlap as a function 
of p itself: 



(Ap) = P a A Pa + P r A Pr . 



(29) 



This quantity is shown in Fig. [5] In the case of bidi- 
rectional synchronization for K < 3 it is always positive 
until the process reaches an absorbing state at p = 1. 

While the transition probabilities are independent of 
L, the step sizes decrease asymptotically proportional to 
L~ 2 according to Eqs. (H]) and (HU). That is why (Ap) 
is also proportional to L~ 2 and we find || 



1 



oc 



cx L 



(30) 



for the average number of steps needed for full synchro- 
nization. In fact, the probability P syn c(t) to achieve iden- 
tical weight vectors in A's and B's neural networks in at 
most t steps is given by a Gumbel distribution 



(31) 



with parameters a and /3, which increase proportional to 
L 2 Thus A and B can generate a common key in a 
short time with the help of neural cryptography. 

Additionally, (Ap(p)) is independent of N except for 
finite-size effects, which is clearly visible in Fi g. [21 The 
exact analytical calculation presented in Ref. [l6| yields 



isync oc L 2 In N , because one has to wait until all cor- 
responding weights have identical values. Consequently, 
the partners are able to use rather large neural networks 
without problems. 

However, the situation is completely different in the 
case of learning, e.g., for the simple attack or the ge- 
ometric attack. Now there exists a fixed point of the 
dynamics at pt < 1 with (Ap(pf)) = 0. In the case 
of K = 3, which is the usual choice in regard to neural 
cryptography, we find Pf ~ 0.65 for the simple attack 
and pf ~ 0.68 for the geometric attack. 

As long as p < pf the overlap increases on average, but 
afterwards we observe a quasistationary Gaussian distri- 
bution of p with mean value pf and standard deviation 
<jf. This is clearly visible in Fig. [7] Consequently, the 
absorbing state p — 1 can only be reached by fluctuations 
of the overlap. 

In order to determine the scaling of the standard devi- 
ation (j f of the overlap at the fixed point, we use a linear 
approximation for the dynamics of Ap around pf without 
taking boundary conditions into account 



A P {t) w -j[p(t) - Pf ] + sm . 



(32) 



Here £(i) are random numbers with zero mean and unit 
variance. The parameters are defined as 



7 = - -7-<Ap(p)> 
dp 



p=Pf 



S = 



[Ap(p/)] 2 



(33) 
(34) 



In this model, the time evolution of the overlap is given 
as the solution of Eq. 



(35) 



Pit) ~Pf = E(l - 7)'"^) 



i=l 



using the initial condition p(0) = Pf, which is irrelevant 
in the limit t — > oo. Therefore the fluctuations of the 
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FIG. 8: Standard deviation of p at the fixed point pi. Symbols 
denote results averaged over 10 000 simulations using K — 3, 
N = 1000, and unidirectional synchronization. 



FIG. 10: Time constant tf for synchronization by fluctuations, 
obtained from 1000 simulations of the geometric attack for 
K = 3 and N = 1000. The line shows a fit with Eq. (ggj). 
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FIG. 9: Probability distribution of t sync for K = 3, N = 1000, 
and geometric attack. Symbols denote results averaged over 
1000 simulations and the lines show fits with Eq. (138[) . 



FIG. 11: Average change of the overlap for bidirectional syn- 
chronization, L = 10, and TV = 1000. Symbols denote results 
obtained from 100 simulations. 



overlap in the stationary state are given by 

^ = £(l-7) 2 ^ = ^. 06) 
t=o ' ' 

As the step sizes of the random walk in p-space de- 
crease proportional to L~ 2 for L 3> 1 according to 
Eqs. p^|) and (flH|) , this is also the scaling behavior of 
the parameters 7 and 8. Thus we find 

c/ oc j- (37) 

for larger values of the synaptic depth. Although we 
have neglected the more complex features of (Ap(p)), 
this scaling behavior is clearly visible in Fig. [8j The 
deviations for small values of L are caused by finite-size 
effects. 

Consequently, an attacker E is unable to synchronize 
with A and B in the limit L — * 00, even if she uses the 
geometric attack. This is also true for any other algo- 
rithm, which has a fixed point at pf < 1 in the dynamics 
of the overlap. 



For finite synaptic depth, however, E has a chance 
of getting beyond the fixed point at pf by fluctuations. 
The probability that this event occurs in any given step 
is independent of t once the quasistationary state has 
been reached. That is why P S y nc (t) is no longer given by 
Eq. ([nil, but described well for t 3> to by an exponential 
distribution 

P s f nc (t) = 1 - , (38) 

with time constant t / . This is clearly visible in Fig. [9] 
Because of tf S> to one needs 

(Wnc) » tf (39) 

steps on average to achieve full synchronization by uni- 
directional learning. 

In our simplified model with linear (Ap(p)) the average 
time needed to reach p = 1 starting at the fixed point is 
given by 

tf * P(o=l) =V ^ a f e ^ ( 4 °) 
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FIG. 12: Average change of the overlap between A and C for 
A" = 3, L — 3, and iV = 1000, obtained from 100 simulations 
with 100 pairs of TPMs. 



FIG. 13: Entropy per weight for A and C for K = 3 and 
L — 3. Symbols denote results obtained in 100 simulations 
with 100 pairs of TPMs. 



in the case of small fluctuations er/ <C 1 — Pf, where we 
can assume that the distribution of p is not influenced by 
the presence of the absorbing state at p = 1. Hence we 
expect 

tf oc e cL2 (41) 

for the scaling of the time constant, as a/ changes pro- 
portional to L , while pf stays nearly constant. And 
Fig. [TU] shows that indeed t f grows exponentially with 
increasing synaptic depth 

t f oc e ClL+C2L2 . (42) 

Thus the complexity of attacks on the neural key- 
exchange protocol can be controlled by choosing L. Or 
if E's effort stays constant, her success probability drops 
exponentially with increasing synaptic depth. This has 
been observed in the case of the geometric attack 
and even for advanced methods [H, [l5[ • Consequently, 
A and B can reach any desired level of security by in- 
creasing L, as the complexity of a single key exchange 
grows only proportional to L 2 . 

However, this is not true for K > 3. As shown in 
Fig. QTJ a fixed point at pt < 1 appears in the case of 
bidirectional synchronization, too. Therefore Eq. (|30|) is 
not valid any more and t sync increases exponentially with 
L. That is why TPMs with four and more hidden units 
cannot be used in the neural key-exchange protocol. 

V. NUMBER OF KEYS 

The state of the TPMs in each time step is a func- 
tion of the secret initial conditions and the public se- 
quence of input values. Therefore E can — in principle — 
determine the possible weight configurations at synchro- 
nization time tsync using her knowledge about the input 
vectors x^(i). However, if the number of these keys is 
large, a brute-force attack is unfeasible. Consequently, 



this quantity is important for the security of neural cryp- 
tography, too. 

In order to estimate the number of keys, which can be 
generated by the neural key-exchange protocol using a 
given sequence of inputs, we look at the following system 
consisting of two pairs of TPMs: 





= wf - 




(43) 


wf + 


= wf- 


hx i e(afr B )e(r^r B ), 


(44) 


wf+ 




hx l e(cTfr c )e(T c T D ), 


(45) 


wf+ 






(46) 



In this model all four neural networks receive the same 
sequence of inputs, but both pairs communicate their 
output bits only internally. Thus A and B as well as C 
and D synchronize using the random walk learning rule, 
while correlations caused by common inputs are visible 
in the overlap pf ■ Because of the symmetry in this 
system, pf D , pf c , and pf D have the same properties as 
this quantity, so that it is sufficient to look at pf c only. 

Of course, synchronization of networks which do not 
interact with each other, e.g., A with C, is much more dif- 
ficult and takes a longer time than performing the normal 
key-exchange protocol. That is why we assume p AB = 1 
and p CD = 1 for the calculation of (Ap AC (p AC )) . 

The result is shown in Fig. [T3J Similar to the case of 
unidirectional learning, there is a fixed point at p AC < 1 
for the dynamics of the overlap. Because of p AC < p AE 
the probability for full synchronization in this case is 
much smaller than for a successful simple attack. In fact, 
large fluctuations which lead to equal weights without in- 
teraction only occur in small systems. But the common 
input sequence causes correlations between wf and wp 
even for L ^> 1 and N ^S> 1. Consequently, the number 
of keys n^cy is smaller than the number of weight config- 
urations n con f = (2-L + l) KN of a tree parity machine. 

We further analyze these correlations by calculating 
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FIG. 14: Number of keys for K = 3, L = 1, and N = 2, 
obtained by exhaustive search and averaged over 100 random 
input sequences. 



FIG. 15: Mutual information between A and C for K = 3, 
AT = 1000, obtained in 1000 simulations with 10 pairs of 
TPMs. 



the entropy of the weight distribution 

L L 



S=-KN P^Pa.c- 



(47) 



— L c=-L 



Here p ayC is the probability to find — a and = c 
by selecting a random weight. As the weights in each 
tree parity machine alone stay uniformly distributed, the 
entropy of two fully synchronized networks is given by 



So = lnn conf = KN\n(2L + 1) . 



(48) 



which is also the entropy of a single TPM. Consequently 
the quantity S~ Sq describes the correlations between the 
weight vectors caused by the common input sequence. It 
is proportional to the length of the generated crypto- 
graphic key with any redundancy removed using a suit- 
able encoding. Therefore the logarithm of the effective 
number of keys is given by 



In rikey = S - So- 



(49) 



We note, however, that the real number can be larger, 
because not all possible weight configurations occur with 
equal probability as keys. Therefore rt key is, in fact, a 
lower bound for the number of different final configu- 
rations. However, this quantity determines the security 
against brute- force attacks, as an attacker tries the most 
probable keys first. 

Figure fTS] shows the time evolution of this entropy. 
First S — So shrinks linearly with increasing t, as the 
overlap p between A and C grows while it approaches 
the stationary state. This behavior is consistent with an 
exponential decreasing number of keys, which can be di- 
rectly observed in very small systems as shown in Fig. 1141 
Of course, after the system has reached the fixed point 
shown in Fig. [121 the entropy stays constant. We use this 
minimum value in order to determine rikey 

It is clearly visible that there are two scaling relations 
for S(t). The synchronization time t sync oc L 2 is the time 



scale of all processes related to the synchronization of tree 
parity machines. It depends on the size of the learning 
steps (A/?). Therefore the time needed to reach the fixed 
point of p£ c is proportional to L 2 , too. 

Entropy is an extensive quantity. Thus S and So are 
proportional to the number of weights AT. Consequently 
the number of keys, which can be generated by the neural 
key-exchange protocol for a given input sequence, grows 
exponentially with increasing N. 

In order to determine the dependency between the 
synaptic depth L and rik oy we calculate the mutual infor- 
mation 



I = 2S -S 



(50) 



between A and C, which is visible in the correlations of 
the weight vectors. Using Eqs. I|48p and (|4"9"]l we find 



J = - In 



^kcy 



Therefore the number of keys is given by 



n kcy = n conf e- 1 = \{2L + l) K e - I/N 



N 



(51) 



(52) 



As shown in Fig. [T5l I/N becomes asymptotically in- 
dependent of the synaptic depth in the limit L — > oo. Of 
course, changing N does not influence I/N either, as it is 
an intensive quantity. Extrapolating / yields the result 



0A2N . 



(53) 



which is valid for K = 3 and L 1. Consequently, n^y 
increases exponentially with TV, 



^kcy 



[0.66(2L + 1) 



1 N 



(54) 



so that there are always enough possible keys in larger 
systems to prevent successful brute-force attacks on the 
neural key-exchange protocol. 
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VI. CONCLUSIONS 

Synchronization of neural networks is a dynamical pro- 
cess driven by attractive and repulsive stochastic forces. 
While there is little difference between unidirectional 
and bidirectional interaction in the case of simple net- 
works such as perceptrons, more complex networks such 
as TPMs show an interesting phenomenon: neural net- 
works which interact with each other synchronize faster 
than those, which are only trained with the examples 
generated by others. 

We have investigated the dynamics of this effect, which 
is essential for the recently proposed neural key-exchange 
protocol. In multilayer feed-forward networks the hid- 
den units are not public. Therefore learning steps can 
have either an attractive or repulsive effect. In both 
cases the step size only depends on the synaptic depth 
L and the time-dependent overlap p between the net- 
works. Two neural networks, A and B, learning from 
each other are able to skip unsuitable input vectors be- 
cause of their interaction. That is why they avoid some 
repulsive steps and have a clear advantage over a third 
passive neural network E, which cannot influence A and 
B. Consequently, A and B have a lower frequency of re- 
pulsive learning steps than E, which causes the difference 
between bidirectional synchronization and unidirectional 
learning. 

Using the step sizes Ap a (p), Ap r (p) and transition 
probabilities P a {p), P r {p) we described the process of 



neural synchronization as a random walk of the overlap p. 
The most important properties of the dynamics are visi- 
ble in the average change of the overlap (Ap(p)). In the 
case of K = 3 and bidirectional interaction the dynamics 
of the overlap has only one fixed point at p = 1. That 
is why full synchronization is achieved after (t sync ) oc L 2 
steps on average. However, for unidirectional learning or 
mutual learning with K > 3 there is an additional fixed 
point at pf < 1, so that p = 1 is only reachable by fluc- 
tuations. This leads to a different scaling behavior of the 
average synchronization time (t sync ) oc e ClL+C2L . Thus 
the difference between bidirectional synchronization and 
unidirectional learning can be controlled by choosing the 
synaptic depth L. 

An identical input sequence causes correlations be- 
tween tree parity machines even without any other in- 
teraction. Similarly to the case of unidirectional learning 
there is a fixed point at pf < 1. As the distance 1 — pj 
is larger, full synchronization without interaction is only 
observed for very small TPMs. But the correlations re- 
strict the number of different keys n^ cy , which can be 
generated by the neural key-exchange protocol using a 
certain input sequence and random initial weights. Both 
the configuration space n COD f = (2L+1) KN andnkey grow 
exponentially with increasing number of weights per hid- 
den unit. Therefore a large value of N guarantees the 
security of neural cryptography against brute-force at- 
tacks and similar methods. 
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